AI Governance

AI Governance and Compliance for Oregon Businesses

Your team is already using AI, with or without permission. The question that keeps owners up at night is simple: are we using it in ways that break our policies, leak our secrets, or violate the law? I answer that question with a practical assessment, policies people actually follow, training, and ongoing counsel as the rules change.

For Oregon organizations. I advise Oregon clients on every jurisdiction's rules that reach their operations.

Book a Free 15-Minute Strategy CallSee Pricing

Who this is for

Small and mid-sized Oregon organizations, roughly 10 to 200 people, in healthcare and clinics, credit unions and community banks, professional services, software, and manufacturing. You do not need an AI department. You need to know what your people are actually doing with AI, whether it is safe and legal, and what to write down so that it stays that way.

Four ways to engage

1. AI Use and Compliance Assessment

Flat fee. I inventory how your business actually uses AI, including the shadow AI nobody approved, review your vendor stack and contracts, risk-tier your use cases with hiring and HR uses called out, and map everything against your policies and the laws that reach your operations. You get a written gap report with prioritized fixes, aligned to the NIST AI Risk Management Framework.

2. Policies and Governance Package

Flat fee. An acceptable-use and generative AI policy written for your real workflows, an approval path with named roles, employee handbook integration, a vendor-vetting checklist, an AI incident response plan, and customer disclosure language where required. Includes a rollout training session for your team.

3. Training

Free workshops for Oregon community and business groups (chambers, incubators, economic development organizations). Paid, company-specific training for your team and leadership briefings for boards and executives.

4. Ongoing AI Counsel

Monthly retainer. Law-change monitoring with quarterly policy refreshes, review of new AI vendors and contracts, incident support when something goes wrong, checks on AI marketing claims before they ship, and a standing line to ask questions. Unusual matters outside the retainer are handled at $405 per hour, scoped first.

Where AI meets IP: this practice is unusual because it is run by a registered patent attorney who has published on AI inventorship. Who owns AI-assisted output, whether AI-assisted works can be registered, how to protect prompts, fine-tunes, and data as trade secrets, and how to stop your IP from leaking into public models are not side questions here; they are woven through every assessment. See the patents and trade secrets pages.

The rules that actually apply to you

No scare lists, just the regimes that plausibly reach an Oregon business, each in one sentence. Current as of July 8, 2026; AI law is moving quickly and this page is maintained against it.

Oregon

Oregon Consumer Privacy ActIn effect now: consumers can opt out of profiling used for significant decisions, risk assessments are required before high-risk profiling, and 2026 amendments added mandatory browser opt-out signals and stricter rules for minors' data.
Oregon DOJ guidance on AI (December 2024)The Attorney General's position that existing law already covers AI: misleading AI claims, chatbots posing as humans, and biased AI decisions can violate Oregon's Unlawful Trade Practices Act and related statutes.
Oregon SB 1546 (chatbot law, signed April 2026)Starting January 1, 2027, chatbot operators must disclose that users are not talking to a human and maintain crisis-referral safeguards, with a private right of action for violations.
Oregon employment law (ORS chapter 659A)AI hiring and screening tools that produce discriminatory outcomes create the same exposure as any other discriminatory employment practice.

Federal

FTC Act, Section 5Deceptive claims about what your AI can do, undisclosed AI-generated reviews, and "AI washing" remain active federal enforcement territory in 2026.
Title VII and the ADAFederal employment discrimination statutes apply fully to AI hiring tools; the EEOC's 2023 AI guidance documents were withdrawn in 2025, but the underlying statutes and private lawsuits were never suspended.
Sector rules: HIPAA and GLBAClinics feeding patient information and financial institutions feeding customer data into AI tools carry their full existing data obligations into those tools.

Other states' rules that can reach you

Colorado (SB 26-189)Colorado repealed and replaced its 2024 AI act; the replacement takes effect January 1, 2027 and gives Colorado residents notice, explanation, and human-review rights when automated systems make consequential decisions about them.
IllinoisThe Biometric Information Privacy Act remains the country's most-litigated biometrics law, and since January 1, 2026 Illinois employers and those employing Illinois residents must notify workers when AI is used in employment decisions and avoid discriminatory AI effects.
CaliforniaIf you sell into California: bots that pitch sales must identify themselves, companion chatbots carry disclosure and safety duties, generative AI developers owe training-data summaries, the state's AI Transparency Act takes effect August 2, 2026, and the privacy agency's automated decision-making rules phase in through 2027 (their thresholds exempt most small businesses).

International and frameworks

EU AI ActRelevant only if you serve EU users: transparency duties (disclosing AI interactions and labeling AI-generated content) begin August 2, 2026, while the high-risk system tiers were deferred to late 2027 and 2028 by amendments adopted in June 2026.
NIST AI Risk Management FrameworkThe voluntary framework (with its Generative AI Profile) that my assessments are aligned to; it is the closest thing the U.S. has to a common baseline, and NIST has it under revision.

Start with a workshop, if you like

I regularly give free, plain-English AI and IP workshops to Oregon business groups, and many engagements start there: the workshop surfaces the questions, the strategy call scopes the answer. Ask about booking a workshop for your chamber, incubator, association, or team, or see past presentations.

Common questions

We are a small company. Do we really need an AI policy?

If your employees use AI tools at all, you already have an AI policy; it is just unwritten, inconsistent, and unprotective. A right-sized written policy is usually a few pages, prevents your two most likely losses (confidential data pasted into public tools and bad AI output shipped to customers), and costs far less than either.

Which AI laws apply to an Oregon business?

Start with the list above: Oregon's privacy act and consumer-protection law apply at home, federal law applies everywhere, and other states' rules reach you when you do business there. The assessment maps your actual footprint against them so you stop guessing.

Can you review the AI tools we are about to buy?

Yes. Vendor and procurement review is built into the assessment and the retainer: what the vendor may do with your data, what happens to your prompts and outputs, and whether the contract's promises match the marketing.

Do you serve companies outside Oregon?

AI governance counsel is offered to Oregon organizations. I advise those Oregon clients on any jurisdiction's rules that reach their operations, from California to the EU. For patent work, which is federal, I serve clients nationwide.

Keep learning

From the blog: The AI co-inventor danger, Using AI in the invention process, and Using ChatGPT to draft a provisional, carefully.

Book a Free 15-Minute Strategy CallSee Pricing